InfoSecBulletin Cybersecurity for mankind
TP-Link has revealed several serious security flaws in Aginet networking products managed by ISPs. This includes mesh systems, routers, PON devices, and xDSL modems.
The flaws might let attackers who can connect to the network get around checks, gain higher access, steal important data, look at device files, and run system commands.
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Palo Alto Patches 11 New flaws Across PAN-OS, GlobalProtect, and Prisma Access
CVE-2026-20349, CVE-2026-68820
Cisco and Windows patched zero days exploited in attack
Microsoft Patch 394 Flaws, Including 3 Zero-Days
AI Finds Nation-State-Level Zoom Flaw in Under 24 Hours, Zero-Click Attack Exposed
Hacker Actively Exploit SonicWall and SharePoint Flaws
The security notice, updated on August 10, 2026, lists problems as CVE-2025-30237 to CVE-2025-30241. Internet service providers usually supply, set up, and update the affected products, so firmware may change depending on the provider and area.
The main flaw, CVE-2025-30237, is a way to get around logging in on the web management page. It has a CVSS v4 score of 8.7 and happens because of failed access rules on some links.
An attacker on a nearby network can send special requests to access important functions without login details. If this happens, the attacker could take complete control of the device.
| CVE | Vulnerability | Severity |
|---|---|---|
| CVE-2025-30237 | Authentication bypass | High |
| CVE-2025-30238 | Privilege escalation | High |
| CVE-2025-30239 | Sensitive data exposure | High |
| CVE-2025-30240 | Arbitrary file read | Medium |
| CVE-2025-30241 | OS command injection | High |
Multiple TP-Link Flaws
CVE-2025-30238, rated 8.6, is a mistake in user-management that lets low-level users do admin tasks. This means they might create special accounts or change important settings. An attacker with little access could gain more control over a router or mesh node.
Another high-severity issue, CVE-2025-30239, involves hardcoded cryptographic keys stored in firmware. The vulnerability has a CVSS score of 8.5.
An attacker with access to the device’s storage could recover the embedded keys and decrypt protected configuration data. Exposed information may include credentials and ISP-related service settings, creating a risk of further compromise.
CVE-2025-30240 is a medium-severity arbitrary file-read issue with a CVSS score of 5.1. The flaw affects the USB HTTPS access path and stems from improper handling of symbolic links on external USB storage.
A person who can physically reach the device might make a harmful symbolic link on a supported device and use it to get to important files in the router’s system.
The last flaw, CVE-2025-30241, is a serious flaw that lets attackers run commands on the OS. It has a high danger level of 8.6. This happens because some web parts do not check user input correctly before sending it to system commands.
An attacker on the local network could send commands and run them with higher access, possibly gaining full control of the device. The affected devices are from TP-Link’s HB, HX, HC, EB, EC, EX, XC, XX, and VX series.
HB810, HB710, EX220, EX222, EX920, EC220-G5, XX530v, and VX1800v are some examples. The effect varies based on the model for the area, hardware type, ISP changes, and the firmware installed.
TP-Link said that fixing ISP-managed devices will be done with the help of service providers. Often, updates can be installed automatically using ISP management tools.
Users need to look at the router’s admin page or the provider’s app for firmware updates. If there is no update, customers should reach out to their ISP to see if their device is impacted and when a fix will be available.
Users should limit access to management tools because some problems need local or nearby network access. They should use strong, different passwords for administrators, disable unneeded remote management options, and keep untrusted users away from the local network.
